Autoencoder Unauthorized Access Detection via IP Pattern Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
It is challenging to detect unauthorized access from a terminal infected with malware, as the communication modes and hosts accessed by such terminals can vary, making it difficult to define and learn these patterns, thereby complicating the detection of unauthorized access.
Innovation Solution
An information processing apparatus equipped with a processor that uses an autoencoder to detect unauthorized access by learning from communication logs, where IP addresses of terminals and hosts are used as part of the learning data, allowing the system to identify unusual communication patterns without predefining unauthorized access modes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional detection methods using predefined patterns or frequency-based analysis are used, then detection rules can be established in advance, but they cannot detect unauthorized access with unknown communication modes
Solution Approach 1:
Instead of trying to define what unauthorized access looks like, the patent inverts the approach by learning what normal access patterns are, then detecting deviations from these patterns as unauthorized access. The autoencoder learns legitimate communication behaviors during training, and during detection, inputs that produce high reconstruction errors indicate unauthorized access, eliminating the need to predefine malicious patterns.
Solution Approach 2:
The patent introduces an autoencoder as an intermediary learning model between the raw communication data and the detection decision. This intermediary model learns the complex patterns of normal communication during training and serves as a mediator to identify anomalies, bridging the gap between simple frequency counting and complex pattern recognition without requiring explicit definition of all access modes.
2Measurement precision
If learning machines are trained to recognize security attack patterns, then detection accuracy for known attacks improves, but they fail to detect novel unauthorized access modes
Solution Approach 1:
The patent performs preliminary learning of normal communication patterns during the training phase using legitimate data. The autoencoder learns to reconstruct normal traffic patterns accurately before actual detection begins. This preliminary action of learning what is normal enables the system to detect novel unauthorized access modes without having been explicitly trained on them, as any deviation from the learned normal patterns triggers detection.
3Measurement precision
If detailed communication mode analysis is performed to detect unauthorized access, then detection precision improves, but the system cannot judge whether access is unauthorized when patterns are undefined
Solution Approach 1:
The system performs self-service by automatically learning normal communication patterns from training data without requiring manual definition of what constitutes unauthorized access. The autoencoder independently identifies legitimate behavior patterns during training, then uses these self-learned patterns to autonomously detect deviations indicating unauthorized access, eliminating the need for external experts to define detection criteria.
Data Source
AI summary
An information processing apparatus includes a processor configured to detect unauthorized access from a subject terminal to a subject host as a result of inputting subject input data into an autoencoder, an Internet protocol address of the subject terminal and an Internet protocol address of the subject host being used as at least part of the subject input data, the autoencoder having performed learning by using learning data, an Internet protocol address of a terminal and an Internet protocol address of a host to which the terminal has connected being used as at least part of the learning data.